Privacy policy
INFORMATION NOTICE
Pursuant to Art. 13(1) and (2) of the General Data Protection Regulation of 27 April 2016 (hereinafter the GDPR), I hereby inform you that the controller of personal data (hereinafter the Controller) is ARCommerce Artur Rompca, with its registered office at ul. K. I. Gałczyńskiego 3, 83-330 Żukowo, Poland, VAT ID (NIP): 5891829457, e-mail: arompca@commercraft.com.
Purposes, legal basis and retention period
| No. | Purpose of processing | Legal basis | Retention period |
|---|---|---|---|
| 1. | Conclusion and performance of a contract | [Art. 6(1)(b) GDPR] Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract | Data is kept for the term of the contract and thereafter for the period resulting from tax law and until the parties’ claims under the contract become time-barred |
| 2. | Carrying out the cooperation arising from the contract, in particular ensuring proper communication | [Art. 6(1)(f) GDPR] Processing is necessary for the purposes of the legitimate interests pursued by the controller – ensuring performance and proper communication with the persons named in the contracts and agreements concluded by ARCommerce | Data is kept for the term of the contract |
| 3. | Compliance with legal obligations relating to the keeping and issuing of accounting records and internal reporting | [Art. 6(1)(c) GDPR] Processing is necessary for compliance with a legal obligation to which the controller is subject: • the Act of 29 August 1997, the Tax Ordinance • the Act of 29 September 1994 on accounting • the Act of 26 July 1991 on personal income tax | Data is kept for the period set out in tax and accounting law |
| 4. | Securing potential claims | [Art. 6(1)(f) GDPR] Processing is necessary for the purposes of the legitimate interests pursued by the controller – ensuring the ability to pursue or defend against potential claims | Data is processed until the claims become time-barred under the applicable law |
Recipients of personal data
Your personal data may be disclosed to the providers of IT systems and services that the Controller works with, to advisory and consulting firms, to companies providing document destruction services and to courier companies, and may be made available to authorised bodies upon a documented request.
Your rights
To the extent resulting from the GDPR and subject to the limitations set out in it, you have the right to request access to your data from the Controller, as well as the right to rectification, erasure or restriction of processing, the right to data portability and the right to object to processing.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (www.uodo.gov.pl).
Profiling and automated decision-making
Your personal data will not be used in automated decision-making processes, including profiling, and will not be transferred outside the European Economic Area (EEA).
Obligation to provide personal data
Providing your personal data for the purposes described above is mandatory. It follows from the law, from the contract concluded or from a legitimate interest; providing it is necessary in order to carry out the cooperation with the Controller correctly and lawfully.
DIRECT MARKETING AND COMMERCIAL CONTACT
The rules below apply to people who gave us their data through a form on commercraft.com – including the contact form and the ROI calculator form – and consented to commercial contact.
Controller. The controller of the data is ARCommerce Artur Rompca, ul. K. I. Gałczyńskiego 3, 83-330 Żukowo, Poland, VAT ID (NIP) 5891829457, trading under the Commercraft brand. For all data matters: arompca@commercraft.com.
Purpose and legal basis. We process the data for direct marketing of our services and for commercial contact – presenting an offer, sending materials and information about our services. The basis is your consent (Art. 6(1)(a) GDPR). Separately, under Art. 398 of the Polish Electronic Communications Law, you consent to the use of a specific channel – an e-mail address or a phone number – for sending commercial information and direct marketing. Consent for each channel is independent; you may give one, both or neither.
Scope of data. First name, surname, e-mail address, phone number, company name and the content of your message – to the extent you provide them. We also record the date and time the consent was given, the IP address and the exact wording of the consent you ticked. We do this solely to be able to demonstrate that consent was given.
Voluntary nature. Providing the data and giving consent is voluntary. Without consent we will not contact you on commercial matters. This does not affect your ability to use the content and tools available on the site.
Withdrawal of consent. You may withdraw consent at any time – by e-mail to arompca@commercraft.com or through the link in the footer of every message. Withdrawal does not affect the lawfulness of the processing carried out before it. After withdrawal we delete the data; we keep only a record of the withdrawal itself, so that we can show the request was carried out.
Retention period. Until consent is withdrawn, and if it is not withdrawn – for 3 years from the last contact. After that time we delete the data or ask for consent again.
Recipients of the data. Hosting and e-mail providers, the CRM system, the messaging tool and analytics providers. These entities process the data solely on our instruction, under data processing agreements. Where any of them processes data outside the European Economic Area, this takes place on the basis of standard contractual clauses approved by the European Commission.
Your rights. You have the right of access to your data, and the right to rectification, erasure, restriction of processing, portability, objection and withdrawal of consent. You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
Profiling. We do not take decisions about you based solely on automated processing, including profiling.
B2B COMMERCIAL CONTACT – DATA NOT OBTAINED FROM THE DATA SUBJECT
The clause below fulfils the information obligation under Art. 14 GDPR towards people the Controller contacts on commercial matters and whose personal data it obtained from sources other than those people themselves.
Controller. The controller of personal data is ARCommerce Artur Rompca, ul. K. I. Gałczyńskiego 3, 83-330 Żukowo, Poland, VAT ID (NIP) 5891829457, trading under the Commercraft brand. For all matters concerning the processing of personal data, including objections and opting out of further contact, the address is arompca@commercraft.com.
Source of the data. The Controller obtains data only from sources in which it was published by the data subject or by the company they represent, in particular from business websites and the contact details posted on them, company profiles in industry services, business directories and professional social networks, seller profiles on marketplace platforms, and publicly available business registers (CEIDG, KRS, the VAT taxpayer list). Data may also come from a direct conversation with a company representative, in particular at trade fairs, conferences or other industry events. The Controller does not buy databases from third parties and does not generate contact addresses by automated means. The source from which the data was obtained in a given case is stated by the Controller in the first message sent to that person.
Scope of data. First name and surname, job title or function, business e-mail address, business phone number and data identifying the company represented – to the extent that this information was made available in the source. For this purpose the Controller does not obtain information concerning the private sphere or special categories of data referred to in Art. 9 GDPR.
Purpose and legal basis. The data is processed in order to present the Controller’s services and to establish commercial contact between businesses. The legal basis is the legitimate interest of the Controller, consisting of direct marketing of its own services (Art. 6(1)(f) GDPR in conjunction with recital 47 of the GDPR). Before processing begins, the Controller assesses whether that interest is not overridden by the interests or fundamental rights and freedoms of the data subject. Contact is limited to business addresses and to matters connected with the business activity of the company represented.
Time of providing this information. This information is provided at the latest with the first message sent to the data subject, and no later than one month from obtaining the data (Art. 14(3) GDPR).
Objection and opting out of contact. The data subject has the right to object at any time to the processing of their data for direct marketing purposes (Art. 21(2) GDPR). An objection requires no justification and no particular form – a reply to the message received or a note sent to arompca@commercraft.com is enough. Once an objection is raised, the Controller immediately stops processing the data for that purpose, deletes the contact details and sends no further messages. It keeps only a record of the objection itself – name or address and date – on the basis of Art. 6(1)(f) GDPR, in order to demonstrate that the request was carried out and to avoid contacting the person again.
Retention period. The data is kept until an objection is raised, and in the absence of one – for 12 months from the last message sent to that person. After that period the data is deleted.
Rights of the data subject. The data subject has the right of access to the data (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR). They also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
Profiling. The data is not used in automated decision-making processes, including profiling.
This is a translation of the Polish information notice published at commercraft.com/rodo/. In case of any discrepancy, the Polish version prevails.
